Description
In the Linux kernel, the following vulnerability has been resolved: net: usb: sr9700: include receive overhead in the length check The receive fixup subtracts the Ethernet CRC from the reported packet length, but compares that payload length against the whole remaining receive buffer. The following copy starts after the three-byte header, and the cursor advance consumes both that header and the four-byte CRC. Require the payload to fit after SR_RX_OVERHEAD before copying it or advancing to the next packet. The loop already ensures that the remaining buffer is larger than the overhead, so the subtraction is safe. The issue was found by our static-analysis tool.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
c9b37458e95629b1d1171457afdcc1bf1eb7881d to < 92d88c88390fc62444c00a1a22078f838e03891faffectedc9b37458e95629b1d1171457afdcc1bf1eb7881d to < baf07d5153d3af8f98e65e2d3566bc0d50c4e3acaffectedc9b37458e95629b1d1171457afdcc1bf1eb7881d to < 8488779d9bddbdb33588c9fc2c0657a3da773f61affectedc9b37458e95629b1d1171457afdcc1bf1eb7881d to < e1f5b74edccf4c9b671b6bce4435a98746fe5167affectedc9b37458e95629b1d1171457afdcc1bf1eb7881d to < 9b59b00890c5dea355b4cc8795ab8eeafc044e48affectedc9b37458e95629b1d1171457afdcc1bf1eb7881d to < 6ab6c9d120b30c94579192ef83a581a3dda6d79caffectedc9b37458e95629b1d1171457afdcc1bf1eb7881d to < 05b442709bd5256c6c0e11fe56b9a0cb2455c245affectedc9b37458e95629b1d1171457afdcc1bf1eb7881d to < c06bde80ae7a7b595732f7cabcb92cf08db9d56aaffected
Linux Linux
Default version status: affected
3.12affected0 to < 3.12unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.55 to ≤ 6.18.*unaffected7.2.9 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/92d88c88390fc62444c00a1a22078f838e03891f ↗
- https://git.kernel.org/stable/c/baf07d5153d3af8f98e65e2d3566bc0d50c4e3ac ↗
- https://git.kernel.org/stable/c/8488779d9bddbdb33588c9fc2c0657a3da773f61 ↗
- https://git.kernel.org/stable/c/e1f5b74edccf4c9b671b6bce4435a98746fe5167 ↗
- https://git.kernel.org/stable/c/9b59b00890c5dea355b4cc8795ab8eeafc044e48 ↗
- https://git.kernel.org/stable/c/6ab6c9d120b30c94579192ef83a581a3dda6d79c ↗
- https://git.kernel.org/stable/c/05b442709bd5256c6c0e11fe56b9a0cb2455c245 ↗
- https://git.kernel.org/stable/c/c06bde80ae7a7b595732f7cabcb92cf08db9d56a ↗